aboutsummaryrefslogtreecommitdiff
path: root/hw/sd
AgeCommit message (Collapse)AuthorFilesLines
2024-06-24hw/sd/sdcard: Only call sd_req_get_address() where address is usedPhilippe Mathieu-Daudé1-6/+8
It will be useful later to assert only ADTC commands (Addressed point-to-point Data Transfer Commands, defined as the 'sd_adtc' enum) extract the address value from the command argument. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-18-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Factor sd_req_get_address() method outPhilippe Mathieu-Daudé1-1/+9
Extract sd_cmd_get_address() so we can re-use it in various SDProto handlers. Use CARD_CAPACITY and HWBLOCK_SHIFT definitions instead of magic values. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-17-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Only call sd_req_get_rca() where RCA is usedPhilippe Mathieu-Daudé1-1/+7
It will be useful later to assert only AC commands (Addressed point-to-point Commands, defined as the 'sd_ac' enum) extract the RCA value from the command argument. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-16-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Factor sd_req_get_rca() method outPhilippe Mathieu-Daudé1-6/+9
Extract sd_req_get_rca() so we can re-use it in various SDProto handlers. Return a 16-bit value since RCA is 16-bit. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-15-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Have cmd_valid_while_locked() return a boolean valuePhilippe Mathieu-Daudé1-2/+2
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-14-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Trace update of block count (CMD23)Philippe Mathieu-Daudé2-1/+3
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-12-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Remove explicit entries for illegal commandsPhilippe Mathieu-Daudé1-11/+0
NULL handler is already handled as illegal, no need to duplicate (that keeps this array simpler to maintain). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-9-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Remove ACMD6 handler for SPI modePhilippe Mathieu-Daudé1-1/+1
There is no ACMD6 command in SPI mode, remove the pointless handler introduced in commit 946897ce18 ("sdcard: handles more commands in SPI mode"). Keep sd_cmd_unimplemented() since we'll reuse it later. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-8-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Use Load/Store API to fill some CID/CSD registersPhilippe Mathieu-Daudé1-7/+2
The ld/st API helps noticing CID or CSD bytes refer to the same field. Multi-bytes fields are stored MSB first in CID / CSD. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-7-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Use registerfield CSR::CURRENT_STATE definitionPhilippe Mathieu-Daudé1-2/+2
Use registerfield-generated definitions to update card_status. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-6-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Use HWBLOCK_SHIFT definition instead of magic valuesPhilippe Mathieu-Daudé1-3/+3
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-5-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Fix typo in SEND_OP_COND command namePhilippe Mathieu-Daudé2-4/+4
There is no SEND_OP_CMD but SEND_OP_COND. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-4-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Rewrite sd_cmd_ALL_SEND_CID using switch case (CMD2)Philippe Mathieu-Daudé1-5/+5
Keep this handler style in sync with other handlers by using a switch() case, which might become handy to handle other states. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-3-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Correct code indentationPhilippe Mathieu-Daudé1-17/+17
Fix mis-alignment from commits 793d04f495 and 6380cd2052 ("Add sd_cmd_SEND_TUNING_BLOCK" and "Add sd_cmd_SET_BLOCK_COUNT"). Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@redhat.com> Tested-by: Cédric Le Goater <clg@redhat.com> Message-Id: <20240621080554.18986-2-philmd@linaro.org>
2024-06-24hw/sd/sdcard: Avoid OOB in sd_read_byte() during unexpected CMD switchPhilippe Mathieu-Daudé1-0/+7
For multi-bytes commands, our implementation uses the @data_start and @data_offset fields to track byte access. We initialize the command start/offset in buffer once. Malicious guest might abuse by switching command while staying in the 'transfer' state, switching command buffer size, and our implementation can access out of buffer boundary. For example, CMD17 (READ_SINGLE_BLOCK) allows to read up to 512 bytes, and CMD13 (SEND_STATUS) up to 64 bytes. By switching from CMD17 to CMD13 (see reproducer below), bytes [64-511] are out of the 'status' buffer. Our implementation return R0 status code for unexpected commands. Such in-transaction command switch is unexpected and returns R0. This is a good place to reset the start/offset fields to avoid malicious accesses. Can be reproduced running: $ export UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=1 $ cat << EOF | qemu-system-i386 \ -display none -nographic \ -machine accel=qtest -m 512M \ -nodefaults \ -device sdhci-pci,sd-spec-version=3 \ -device sd-card,drive=mydrive \ -drive if=none,index=0,file=null-co://,format=raw,id=mydrive \ -qtest stdio -trace sd\* -trace -sdbus_read outl 0xcf8 0x80001010 outl 0xcfc 0xe0000000 outl 0xcf8 0x80001004 outw 0xcfc 0x02 write 0xe000002c 0x1 0x05 write 0xe000000f 0x1 0x37 write 0xe000000a 0x1 0x01 write 0xe000000f 0x1 0x29 write 0xe000000f 0x1 0x02 write 0xe000000f 0x1 0x03 write 0xe000000c 0x1 0x32 write 0xe000000f 0x1 0x06 write 0xe0000005 0x1 0x01 write 0xe0000007 0x1 0x01 write 0xe0000003 0x1 0x00 write 0xe000000f 0x1 0x11 write 0xe000002a 0x1 0x01 write 0xe000002a 0x1 0x02 write 0xe000000f 0x1 0x0d write 0xe000002a 0x1 0x01 write 0xe000002a 0x1 0x02 EOF hw/sd/sd.c:1984:15: runtime error: index 256 out of bounds for type 'uint8_t [64]' #0 sd_read_byte hw/sd/sd.c:1984:15 #1 sdbus_read_data hw/sd/core.c:157:23 #2 sdhci_read_block_from_card hw/sd/sdhci.c:423:9 #3 sdhci_blkgap_write hw/sd/sdhci.c:1074:13 #4 sdhci_write hw/sd/sdhci.c:1195:13 #5 memory_region_write_accessor softmmu/memory.c:492:5 #6 access_with_adjusted_size softmmu/memory.c:554:18 #7 memory_region_dispatch_write softmmu/memory.c #8 flatview_write_continue softmmu/physmem.c:2778:23 #9 flatview_write softmmu/physmem.c:2818:14 #10 address_space_write softmmu/physmem.c:2910:18 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/sd/sd.c:1984:15 Reported-by: Alexander Bulekov <alxndr@bu.edu> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/487 Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36240 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240408141717.66154-2-philmd@linaro.org>
2024-04-10hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is setPhilippe Mathieu-Daudé1-0/+8
Per "SD Host Controller Standard Specification Version 3.00": * 2.2.5 Transfer Mode Register (Offset 00Ch) Writes to this register shall be ignored when the Command Inhibit (DAT) in the Present State register is 1. Do not update the TRNMOD register when Command Inhibit (DAT) bit is set to avoid the present-status register going out of sync, leading to malicious guest using DMA mode and overflowing the FIFO buffer: $ cat << EOF | qemu-system-i386 \ -display none -nographic -nodefaults \ -machine accel=qtest -m 512M \ -device sdhci-pci,sd-spec-version=3 \ -device sd-card,drive=mydrive \ -drive if=none,index=0,file=null-co://,format=raw,id=mydrive \ -qtest stdio outl 0xcf8 0x80001013 outl 0xcfc 0x91 outl 0xcf8 0x80001001 outl 0xcfc 0x06000000 write 0x9100002c 0x1 0x05 write 0x91000058 0x1 0x16 write 0x91000005 0x1 0x04 write 0x91000028 0x1 0x08 write 0x16 0x1 0x21 write 0x19 0x1 0x20 write 0x9100000c 0x1 0x01 write 0x9100000e 0x1 0x20 write 0x9100000f 0x1 0x00 write 0x9100000c 0x1 0x00 write 0x91000020 0x1 0x00 EOF Stack trace (part): ================================================================= ==89993==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000029900 at pc 0x55d5f885700d bp 0x7ffc1e1e9470 sp 0x7ffc1e1e9468 WRITE of size 1 at 0x615000029900 thread T0 #0 0x55d5f885700c in sdhci_write_dataport hw/sd/sdhci.c:564:39 #1 0x55d5f8849150 in sdhci_write hw/sd/sdhci.c:1223:13 #2 0x55d5fa01db63 in memory_region_write_accessor system/memory.c:497:5 #3 0x55d5fa01d245 in access_with_adjusted_size system/memory.c:573:18 #4 0x55d5fa01b1a9 in memory_region_dispatch_write system/memory.c:1521:16 #5 0x55d5fa09f5c9 in flatview_write_continue system/physmem.c:2711:23 #6 0x55d5fa08f78b in flatview_write system/physmem.c:2753:12 #7 0x55d5fa08f258 in address_space_write system/physmem.c:2860:18 ... 0x615000029900 is located 0 bytes to the right of 512-byte region [0x615000029700,0x615000029900) allocated by thread T0 here: #0 0x55d5f7237b27 in __interceptor_calloc #1 0x7f9e36dd4c50 in g_malloc0 #2 0x55d5f88672f7 in sdhci_pci_realize hw/sd/sdhci-pci.c:36:5 #3 0x55d5f844b582 in pci_qdev_realize hw/pci/pci.c:2092:9 #4 0x55d5fa2ee74b in device_set_realized hw/core/qdev.c:510:13 #5 0x55d5fa325bfb in property_set_bool qom/object.c:2358:5 #6 0x55d5fa31ea45 in object_property_set qom/object.c:1472:5 #7 0x55d5fa332509 in object_property_set_qobject om/qom-qobject.c:28:10 #8 0x55d5fa31f6ed in object_property_set_bool qom/object.c:1541:15 #9 0x55d5fa2e2948 in qdev_realize hw/core/qdev.c:292:12 #10 0x55d5f8eed3f1 in qdev_device_add_from_qdict system/qdev-monitor.c:719:10 #11 0x55d5f8eef7ff in qdev_device_add system/qdev-monitor.c:738:11 #12 0x55d5f8f211f0 in device_init_func system/vl.c:1200:11 #13 0x55d5fad0877d in qemu_opts_foreach util/qemu-option.c:1135:14 #14 0x55d5f8f0df9c in qemu_create_cli_devices system/vl.c:2638:5 #15 0x55d5f8f0db24 in qmp_x_exit_preconfig system/vl.c:2706:5 #16 0x55d5f8f14dc0 in qemu_init system/vl.c:3737:9 ... SUMMARY: AddressSanitizer: heap-buffer-overflow hw/sd/sdhci.c:564:39 in sdhci_write_dataport Add assertions to ensure the fifo_buffer[] is not overflowed by malicious accesses to the Buffer Data Port register. Fixes: CVE-2024-3447 Cc: qemu-stable@nongnu.org Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Buglink: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=58813 Reported-by: Alexander Bulekov <alxndr@bu.edu> Reported-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-Id: <CAFEAcA9iLiv1XGTGKeopgMa8Y9+8kvptvsb8z2OBeuy+5=NUfg@mail.gmail.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-Id: <20240409145524.27913-1-philmd@linaro.org>
2023-12-30hw/sd: Constify VMStateRichard Henderson10-14/+14
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20231221031652.119827-53-richard.henderson@linaro.org>
2023-11-07hw/sd: Declare QOM types using DEFINE_TYPES() macroPhilippe Mathieu-Daudé10-151/+113
When multiple QOM types are registered in the same file, it is simpler to use the the DEFINE_TYPES() macro. In particular because type array declared with such macro are easier to review. Mechanical transformation using the following comby script: [pattern-x1] match=''' static const TypeInfo :[i1~.*_info] = { :[body] }; static void :[rt1~.*_register_type.](void) { type_register_static(&:[i2~.*_info]); } type_init(:[rt2~.*_register_type.]) ''' rewrite=''' static const TypeInfo :[i1][] = { { :[body] }, }; DEFINE_TYPES(:[i1]) ''' rule='where :[i1] == :[i2], :[rt1] == :[rt2]' [pattern-x2] match=''' static const TypeInfo :[i1a~.*_info] = { :[body1] }; ... static const TypeInfo :[i2a~.*_info] = { :[body2] }; static void :[rt1~.*_register_type.](void) { type_register_static(&:[i1b~.*_info]); type_register_static(&:[i2b~.*_info]); } type_init(:[rt2~.*_register_type.]) ''' rewrite=''' static const TypeInfo :[i1a][] = { { :[body1] }, { :[body2] }, }; DEFINE_TYPES(:[i1a]) ''' rule=''' where :[i1a] == :[i1b], :[i2a] == :[i2b], :[rt1] == :[rt2] ''' and re-indented manually. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Message-Id: <20231031080603.86889-2-philmd@linaro.org>
2023-10-27hw/sd/pxa2xx: Do not open-code sysbus_create_simple()Philippe Mathieu-Daudé1-6/+1
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20231020130331.50048-3-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-10-27hw/sd/pxa2xx: Realize sysbus device before accessing itPhilippe Mathieu-Daudé1-1/+1
sysbus_mmio_map() and sysbus_connect_irq() should not be called on unrealized device. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20231020130331.50048-2-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-10-19hw/sd/sdhci: Block Size Register bits [14:12] is lostLu Gao1-4/+11
Block Size Register bits [14:12] is SDMA Buffer Boundary, it is missed in register write, but it is needed in SDMA transfer. e.g. it will be used in sdhci_sdma_transfer_multi_blocks to calculate boundary_ variables. Missing this field will cause wrong operation for different SDMA Buffer Boundary settings. Fixes: d7dfca0807 ("hw/sdhci: introduce standard SD host controller") Fixes: dfba99f17f ("hw/sdhci: Fix DMA Transfer Block Size field") Signed-off-by: Lu Gao <lu.gao@verisilicon.com> Signed-off-by: Jianxian Wen <jianxian.wen@verisilicon.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-ID: <20220321055618.4026-1-lu.gao@verisilicon.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-09-06Merge tag 'pull-aspeed-20230901' of https://github.com/legoater/qemu into ↵Stefan Hajnoczi2-134/+216
staging aspeed queue: * Fixes for the Aspeed I2C model * New SDK image for avocado tests * blockdev support for flash device definition * SD refactoring preparing ground for eMMC support # -----BEGIN PGP SIGNATURE----- # # iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmTxsaQACgkQUaNDx8/7 # 7KGXmg//XJNisscl/VWSBaGmH5MbQUAg/QCRalXx1V/lJ8rhE/JqwnWKuoPFd4EN # iDlh3ufpzxPhHFc9boechuM5ytlrJxpLJoCIJ4sw/4qnO3Dy3Q6BCy1t8Ma62D1u # oE7cAMHsriJ1uTJNHUTFo72VapTaH2XwFN9lFDuQW45d+WWAXtVJsqvRgFETNmw6 # YYnTTpH2gLTZZFEgOixhWpGLh4Ibc/l8U1VzL0ctQmC11xng0bqk3PAqU9NGzcM5 # MJmEGAxg43CnFu9NJI1nMqC/coi/8PFtrM7HprSwE3H8Jkwncs4ePVT+kZQC+VNQ # 7EaVkksfEGHlN8XP5+eQDrQ5yT6ve+fbHTLQhwULfeyt0GlQ8h1yewvHCDWo/zw3 # XI1ZyOcNZ2yiaenSUrTPzu0LiqZEJQnzRjPCpgTi1fU08ryEMEaPtr176YDLCguQ # cpRj4QSZHCrGl/Eo9NlkFP/2rQDKTvCcedKPkYLQtsurSiH/36Oj9YvZycNtZ574 # ortKAtru4YV/rglNX4L8JDhdI+nqvy1liifpJsiS/2KBZDpVFaP8PzGIV40HNy3G # 8/LVTnaggZaScF3ftHhkg84uQumELS9l2dhsNCL9HqdlrNXLQrVAIR6iuQlpOKBa # 5S/6h7ZXGOb1qNVQjYp4HCrB7X1KIJYksZ3GdUREf8ot5Ds1FhE= # =ymmX # -----END PGP SIGNATURE----- # gpg: Signature made Fri 01 Sep 2023 05:40:52 EDT # gpg: using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1 # gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [unknown] # gpg: aka "Cédric Le Goater <clg@kaod.org>" [unknown] # gpg: WARNING: This key is not certified with a trusted signature! # gpg: There is no indication that the signature belongs to the owner. # Primary key fingerprint: A0F6 6548 F048 95EB FE6B 0B60 51A3 43C7 CFFB ECA1 * tag 'pull-aspeed-20230901' of https://github.com/legoater/qemu: (26 commits) hw/sd: Introduce a "sd-card" SPI variant model hw/sd: Add sd_cmd_SET_BLOCK_COUNT() handler hw/sd: Add sd_cmd_SEND_TUNING_BLOCK() handler hw/sd: Add sd_cmd_SEND_RELATIVE_ADDR() handler hw/sd: Add sd_cmd_ALL_SEND_CID() handler hw/sd: Add sd_cmd_SEND_OP_CMD() handler hw/sd: Add sd_cmd_GO_IDLE_STATE() handler hw/sd: Add sd_cmd_unimplemented() handler hw/sd: Add sd_cmd_illegal() handler hw/sd: Introduce sd_cmd_handler type hw/sd: Move proto_name to SDProto structure hw/sd: When card is in wrong state, log which spec version is used hw/sd: When card is in wrong state, log which state it is hw/sd/sdcard: Return ILLEGAL for CMD19/CMD23 prior SD spec v3.01 aspeed: Get the BlockBackend of FMC0 from the flash device m25p80: Introduce an helper to retrieve the BlockBackend of a device aspeed: Create flash devices only when defaults are enabled hw/ssi: Check for duplicate CS indexes aspeed/smc: Wire CS lines at reset hw/ssi: Introduce a ssi_get_cs() helper ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2023-09-01hw/sd: Introduce a "sd-card" SPI variant modelCédric Le Goater1-14/+40
and replace the SDState::spi attribute with a test checking the SDProto array of commands. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SET_BLOCK_COUNT() handlerPhilippe Mathieu-Daudé1-14/+16
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SEND_TUNING_BLOCK() handlerJoel Stanley1-11/+17
Signed-off-by: Joel Stanley <joel@jms.id.au> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SEND_RELATIVE_ADDR() handlerPhilippe Mathieu-Daudé1-13/+15
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-11-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_ALL_SEND_CID() handlerPhilippe Mathieu-Daudé1-11/+12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-10-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_SEND_OP_CMD() handlerPhilippe Mathieu-Daudé2-10/+10
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [ clg: Update cmd_abbrev ] Message-Id: <20210624142209.1193073-9-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_GO_IDLE_STATE() handlerPhilippe Mathieu-Daudé1-12/+12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-8-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_unimplemented() handlerPhilippe Mathieu-Daudé1-9/+12
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> [ clg: Fix redundant assignment of .cmd ] Message-Id: <20210624142209.1193073-7-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Add sd_cmd_illegal() handlerPhilippe Mathieu-Daudé1-36/+26
Log illegal commands as GUEST_ERROR. Note: we are logging back the SDIO commands (CMD5, CMD52-54). Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-6-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Introduce sd_cmd_handler typePhilippe Mathieu-Daudé1-0/+13
Add 2 command handler arrays in SDProto, for CMD and ACMD. Have sd_normal_command() / sd_app_command() use these arrays: if an command handler is registered, call it, otherwise fall back to current code base. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-5-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: Move proto_name to SDProto structurePhilippe Mathieu-Daudé1-8/+27
Introduce a new structure to hold the bus protocol specific fields: SDProto. The first field is the protocol name. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-4-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: When card is in wrong state, log which spec version is usedPhilippe Mathieu-Daudé1-2/+16
Add the sd_version_str() helper. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd: When card is in wrong state, log which state it isPhilippe Mathieu-Daudé1-3/+9
We report the card is in an inconsistent state, but don't precise in which state it is. Add this information, as it is useful when debugging problems. Since we will reuse this code, extract as sd_invalid_state_for_cmd() helper. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20210624142209.1193073-2-f4bug@amsat.org> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-09-01hw/sd/sdcard: Return ILLEGAL for CMD19/CMD23 prior SD spec v3.01Philippe Mathieu-Daudé1-2/+2
CMD19 (SEND_TUNING_BLOCK) and CMD23 (SET_BLOCK_COUNT) were added in the Physical Layer Simplified Specification v3.01. When earlier spec version is requested, we should return ILLEGAL. Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20220509141320.98374-1-philippe.mathieu.daude@gmail.com> Signed-off-by: Cédric Le Goater <clg@kaod.org>
2023-08-31hw/sd: spelling fixesMichael Tokarev2-2/+2
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Message-ID: <20230823065335.1919380-18-mjt@tls.msk.ru> Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
2023-07-25hw/sd/sdhci: Do not force sdhci_mmio_*_ops onto all SD controllersBernhard Beschow1-1/+7
Since commit c0a55a0c9da2 "hw/sd/sdhci: Support big endian SD host controller interfaces" sdhci_common_realize() forces all SD card controllers to use either sdhci_mmio_le_ops or sdhci_mmio_be_ops, depending on the "endianness" property. However, there are device models which use different MMIO ops: TYPE_IMX_USDHC uses usdhc_mmio_ops and TYPE_S3C_SDHCI uses sdhci_s3c_mmio_ops. Forcing sdhci_mmio_le_ops breaks SD card handling on the "sabrelite" board, for example. Fix this by defaulting the io_ops to little endian and switch to big endian in sdhci_common_realize() only if there is a matchig big endian variant available. Fixes: c0a55a0c9da2 ("hw/sd/sdhci: Support big endian SD host controller interfaces") Signed-off-by: Bernhard Beschow <shentey@gmail.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-Id: <20230709080950.92489-1-shentey@gmail.com>
2023-06-20meson: Replace softmmu_ss -> system_ssPhilippe Mathieu-Daudé1-12/+12
We use the user_ss[] array to hold the user emulation sources, and the softmmu_ss[] array to hold the system emulation ones. Hold the latter in the 'system_ss[]' array for parity with user emulation. Mechanical change doing: $ sed -i -e s/softmmu_ss/system_ss/g $(git grep -l softmmu_ss) Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-Id: <20230613133347.82210-10-philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
2023-06-19hw/sd/allwinner-sdhost: Don't send non-boolean IRQ line levelsPeter Maydell1-1/+1
QEMU allows qemu_irq lines to transfer arbitrary integers. However the convention is that for a simple IRQ line the values transferred are always 0 and 1. The A10 SD controller device instead assumes a 0-vs-non-0 convention, which happens to work with the interrupt controller it is wired up to. Coerce the value to boolean to follow our usual convention. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Guenter Roeck <linux@roeck-us.net> Message-id: 20230606104609.3692557-3-peter.maydell@linaro.org
2023-06-06hw: sd: allwinner-sdhost: Add sun50i-a64 SoC supportqianfan Zhao1-3/+69
A64's sd register was similar to H3, and it introduced a new register named SAMP_DL_REG location at 0x144. The dma descriptor buffer size of mmc2 is only 8K and the other mmc controllers has 64K. Also fix allwinner-r40's mmc controller type. Signed-off-by: qianfan Zhao <qianfanguijin@163.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2023-05-02hw/sd/allwinner-sdhost: Correctly byteswap descriptor fieldsPeter Maydell1-5/+26
In allwinner_sdhost_process_desc() we just read directly from guest memory into a host TransferDescriptor struct and back. This only works on little-endian hosts. Abstract the reading and writing of descriptors into functions that handle the byte-swapping so that TransferDescriptor structs as seen by the rest of the code are always in host-order. This fixes a failure of one of the avocado tests on s390. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Message-id: 20230424165053.1428857-2-peter.maydell@linaro.org
2023-03-20replace TABs with spacesYeqi Fu1-92/+92
Bring the files in line with the QEMU coding style, with spaces for indentation. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/378 Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com> Message-Id: <20230315032649.57568-1-fufuyqqqqqq@gmail.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2023-01-12hw/arm/omap: Drop useless casts from void * to pointerPhilippe Mathieu-Daudé1-5/+4
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20230109140306.23161-4-philmd@linaro.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-12-21hw/sd/sdhci: Support big endian SD host controller interfacesPhilippe Mathieu-Daudé2-3/+30
Some SDHCI IP can be synthetized in various endianness: https://github.com/u-boot/u-boot/blob/v2021.04/doc/README.fsl-esdhc - CONFIG_SYS_FSL_ESDHC_BE ESDHC IP is in big-endian mode. Accessing ESDHC registers can be determined by ESDHC IP's endian mode or processor's endian mode. Our current implementation is little-endian. In order to support big endianness: - Rename current MemoryRegionOps as sdhci_mmio_le_ops ('le') - Add an 'endianness' property to SDHCIState (default little endian) - Set the 'io_ops' field in realize() after checking the property - Add the sdhci_mmio_be_ops (big-endian) MemoryRegionOps. Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Bernhard Beschow <shentey@gmail.com> Message-Id: <20221101222934.52444-3-philmd@linaro.org> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-11-21hw/sd: Fix sun4i allwinner-sdhost for U-BootStrahinja Jankovic1-21/+46
Trying to run U-Boot for Cubieboard (Allwinner A10) fails because it cannot access SD card. The problem is that FIFO register in current allwinner-sdhost implementation is at the address corresponding to Allwinner H3, but not A10. Linux kernel is not affected since Linux driver uses DMA access and does not use FIFO register for reading/writing. This patch adds new class parameter `is_sun4i` and based on that parameter uses register at offset 0x100 either as FIFO register (if sun4i) or as threshold register (if not sun4i; in this case register at 0x200 is FIFO register). Tested with U-Boot and Linux kernel image built for Cubieboard and OrangePi PC. Signed-off-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 20221112214900.24152-1-strahinja.p.jankovic@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2022-10-28hw/sd/sdhci: Rename ESDHC_* defines to USDHC_*Bernhard Beschow1-33/+33
The device model's functions start with "usdhc_", so rename the defines accordingly for consistency. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Message-Id: <20221018210146.193159-5-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-10-28hw/sd/sdhci-internal: Unexport ESDHC definesBernhard Beschow2-20/+19
These defines aren't used outside of sdhci.c, so can be defined there. Signed-off-by: Bernhard Beschow <shentey@gmail.com> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-Id: <20221018210146.193159-4-shentey@gmail.com> Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2022-07-12block: Change blk_{pread,pwrite}() param orderAlberto Faria1-2/+2
Swap 'buf' and 'bytes' around for consistency with blk_co_{pread,pwrite}(), and in preparation to implement these functions using generated_co_wrapper. Callers were updated using this Coccinelle script: @@ expression blk, offset, buf, bytes, flags; @@ - blk_pread(blk, offset, buf, bytes, flags) + blk_pread(blk, offset, bytes, buf, flags) @@ expression blk, offset, buf, bytes, flags; @@ - blk_pwrite(blk, offset, buf, bytes, flags) + blk_pwrite(blk, offset, bytes, buf, flags) It had no effect on hw/block/nand.c, presumably due to the #if, so that file was updated manually. Overly-long lines were then fixed by hand. Signed-off-by: Alberto Faria <afaria@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220705161527.1054072-4-afaria@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
2022-07-12block: Add a 'flags' param to blk_pread()Alberto Faria1-1/+1
For consistency with other I/O functions, and in preparation to implement it using generated_co_wrapper. Callers were updated using this Coccinelle script: @@ expression blk, offset, buf, bytes; @@ - blk_pread(blk, offset, buf, bytes) + blk_pread(blk, offset, buf, bytes, 0) It had no effect on hw/block/nand.c, presumably due to the #if, so that file was updated manually. Overly-long lines were then fixed by hand. Signed-off-by: Alberto Faria <afaria@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Greg Kurz <groug@kaod.org> Reviewed-by: Hanna Reitz <hreitz@redhat.com> Message-Id: <20220705161527.1054072-3-afaria@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
generated by cgit v1.1 at 2025-09-19 21:28:07 +0000